org.webjars.npm:toml 2.3.3

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:toml package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Uncontrolled Recursion Affected versions of this package are vulnerable to Uncontrolled Recursion in `lib/parser.js`, where the mutually recursive `peg$parsevalue()`, `peg$parsearray()`, and `peg$parseinline_table_entry()` functions recurse to the input's nesting depth with no depth limit. An attacker can crash the process with a `RangeError: Maximum call stack size exceeded` by supplying a deeply nested TOML document, such as a ~6 KB payload nested about 2,500 levels (`a=[[[...]]]`). This requires the application to call `toml.parse()` on untrusted input, and error handlers that catch only `SyntaxError` do not contain the resulting `RangeError`, which is not a `SyntaxError` subclass. How to fix Uncontrolled Recursion? A fix was pushed into the `master` branch but not yet published.	[0,)
H Prototype Pollution Affected versions of this package are vulnerable to Prototype Pollution in the `deepRef` function of `lib/compiler.js`, which traverses through a scalar value into the prototype chain, and whose containment guard is missed because `currentPath` inconsistently holds arrays that coerce to comma-separated strings (`"a,b"`) while the guard checks dot-separated paths (`"a.b"`). An attacker can inject arbitrary properties onto `Object.prototype`, affecting every object in the process, by supplying a TOML document whose table path steps through a scalar into `__proto__.__proto__`, for example `[a.b.y.__proto__.__proto__]` after `y = 1`. This requires the application to parse attacker-controlled TOML. How to fix Prototype Pollution? A fix was pushed into the `master` branch but not yet published.	[0,)

Vulnerability

Vulnerable Version

Uncontrolled Recursion

Affected versions of this package are vulnerable to Uncontrolled Recursion in lib/parser.js, where the mutually recursive peg$parsevalue(), peg$parsearray(), and peg$parseinline_table_entry() functions recurse to the input's nesting depth with no depth limit. An attacker can crash the process with a RangeError: Maximum call stack size exceeded by supplying a deeply nested TOML document, such as a ~6 KB payload nested about 2,500 levels (a=[[[...]]]). This requires the application to call toml.parse() on untrusted input, and error handlers that catch only SyntaxError do not contain the resulting RangeError, which is not a SyntaxError subclass.

How to fix Uncontrolled Recursion?

A fix was pushed into the master branch but not yet published.

[0,)

Prototype Pollution

Affected versions of this package are vulnerable to Prototype Pollution in the deepRef function of lib/compiler.js, which traverses through a scalar value into the prototype chain, and whose containment guard is missed because currentPath inconsistently holds arrays that coerce to comma-separated strings ("a,b") while the guard checks dot-separated paths ("a.b"). An attacker can inject arbitrary properties onto Object.prototype, affecting every object in the process, by supplying a TOML document whose table path steps through a scalar into __proto__.__proto__, for example [a.b.y.__proto__.__proto__] after y = 1. This requires the application to parse attacker-controlled TOML.

How to fix Prototype Pollution?

A fix was pushed into the master branch but not yet published.

[0,)

org.webjars.npm:toml@2.3.3

latest version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically